Merge pull request #1138 from fschwahn/update_without_password

added update_without_password method, closes #801

lib/devise/models/database_authenticatable.rb

@@ -68,6 +68,17 @@ module Devise
         result
       end
 
+      # Update record attributes without asking for the current password. Never allow to
+      # change the current password
+      def update_without_password(params={})
+        params.delete(:password)
+        params.delete(:password_confirmation)
+
+        result = update_attributes(params)
+        clean_up_passwords
+        result
+      end
+      
       def after_database_authentication
       end
 

test/models/database_authenticatable_test.rb

@@ -141,6 +141,19 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase
     assert user.password_confirmation.blank?
   end
 
+  test 'should update the user without password' do
+    user = create_user
+    user.update_without_password(:email => 'new@example.com')
+    assert_equal 'new@example.com', user.email
+  end
+
+  test 'should not update password without password' do
+    user = create_user
+    user.update_without_password(:password => 'pass321', :password_confirmation => 'pass321')
+    assert !user.reload.valid_password?('pass321')
+    assert user.valid_password?('123456')
+  end
+
   test 'downcase_keys with validation' do
     user = User.create(:email => "HEllO@example.com", :password => "123456")
     user = User.create(:email => "HEllO@example.com", :password => "123456")